If you’re using php a better way to authenticate would be to use sessions and have the server set a variable in the $_SESSION array. You might also want to set a initial login timestamp value in that array, as well as a “last action” timestamp, and write your security rules based on these.

Another way of doing security in an *AMP environment is to store that data in a database table (currently logged in users) and use the session key (which is stored in a cookie or can be appended to the url if cookies are off). This is the method that expression engine uses and is quite secure.

You can then set up your rules on the server side so users are prompted for passwords more or less frequently, according to the level of security you need.

Been looking into this a bit more.

There’s a jQuery MD5 script here: http://www.semnanweb.com/jquery-plugin/md5.html

I think storing the encrypted MD5 password in the cookie then matching that to the password in the db via an MD5 comparison.

So as an example jQuery to PHP query:

jQuery:
// get user name and passwrord values
var user = $(“#user_name”).val();
var pwd = trim( $(“#user_pwd”).val() );

// make ajax call with data
$.ajax({
type: “POST”,
url: “login.php”,
data: ‘user=’+ user + ‘&pwd=’ + $.md5( pwd ),
success: loginResponse
});

php:

// get password from post vars
$pwd = mysql_real_escape_string( $_POST['pwd'] );

// query string – using sql md5()
$query = “SELECT `user_password` FROM `tbl_users `WHERE MD5( `user_password` ) = ‘”.pwd.”‘” ;

// now run query…

On a successful match you can then store you cookie data, storing the password as md5.

I think this is a good way to do it. :)

That’s good to know regarding secure transmit of data, but as far as I understand it the cookie is stored locally, on the users machine, right?

So you are storing the users password unencrypted in a cookie, which can be accessed and viewed.

I was thinking more along the lines of MD5 cryptography for the password/string? see here: http://pajhome.org.uk/crypt/md5/

B ;)

You can set the secure flag for the cookies so they are only transmitted via secured connections (SSL).

For example:

$.cookie(‘username’, username, { expires: 14, secure: true });

Works a charm. Although isn’t it a bad idea to store the users password unprotected in a cookie?

Is there any encryption that can be applied?

B ;)

Thanks for this.